Hi everyone, I have a very basic search outputting two types of entries into a field called "event". I need to get a count of each type per hour. I've been able to get the view I want using the pivot...
I want to use a 'where' clause (which allows the comparison of two fields) as a pivot constraint. My original search is
index=maillog (event=SEND OR event=RECEIVE)
Which gives me all the s...
I have index=webserver_logs and source=security_logs and can search both in a single query:
index=webserver_logs | append [search source=security_logs]
I get a table with all events and just sele...
...reate a pivot, I've discovered that I can't figure out how to filter the pivot on more than one value of a particular attribute. For example, I'd like to be able to filter my pivot down to customers t...
I'm trying to figure out how to build an excel-like pivot table using 3 or more columns. As example, I have this data:
customer1 project1 note1
customer1 project2
customer1 p...
Hi all, I have a pivot that changes the number of columns based on a drop-down selection. The first two columns remain consistent however the remaining columns can change (1st e.g. has 6...
I have to use a root search in a pivot due to needing to join another data type. Is there a way to get _time to extract as Time? I have setup an eval in the pivot to extract the _time field but it w...
Hi, I have a few columns of data and I would like to generate a pivot table that is similar to the one in Excel.
As an example:
Date/City/Day/Response
-----------------
09-01/New York/Monday/Y...
My problem is nearly identical to the issue listed in this past post (https://answers.splunk.com/answers/508577/pivot-not-showing-results-even-though-sampling-the.html) (not enough Karma to post l...
Hey all,
I've just encountered the pivot command for the first time and after reading through the Splunk page on it, I am still confused as to what it does. If it helps, here is my search q...